Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Usually a limited amount of services are configured on a server and most of the not needed ones are shut down, I was wondering what would be the best approach to firewalling with iptables.

Is it better to filter by denying a specific service from a specific interface or network and leaving unused ports open or is it better so set the chain policy to drop and then start opening up what is needed?

share|improve this question

1 Answer 1

up vote 10 down vote accepted

There are many schools of thought when it comes to system level firewalling.

One conservative approach that is often seen is to use connection tracking to match and explicitly accept incoming RELATED or ESTABLISHED traffic. All other incoming traffic is dropped by default. Explicit rules are added as necessary for various services to accept unmatched incoming traffic.

Outgoing traffic is not filtered in most scenarios.

Example:

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -m conntrack --ctstate INVALID -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT

The above iptables-save snippet shows a setup that drops inbound and forwarding packets by default and accepts outgoing packets by default. Inbound traffic from localhost is explicitly accepted, as are RELATED and ESTABLISHED packets (e.g. responses to an http request), and all traffic to port 22 (SSH).

share|improve this answer
3  
Some would say this isn't conservative enough and you should drop outgoing packets except to destinations you know you should be connecting to: DNS server, mail server (if it should send mail at all), the webservices you consume, the upgrade repository, etc. –  DerfK Feb 19 at 6:29
    
You haven't set connection tracking on the ssh rule? –  Michael Hampton Feb 19 at 11:51
    
@MichaelHampton The rule matching RELATED and ESTABLISHED packets will accept traffic for existing SSH connections. The rule matching port 22 is only necessary to accept the initial incoming connection to that service. –  Mark Sturgill Feb 19 at 17:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.